MEMORANDUM
PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT
To: Howard Bellamy, Partner, Calderwood & Harkness LLP Daniel Ostroff, VP, Legal & Compliance, Lumos Analytics Inc.
From: Robert Jansen, Associate, Calderwood & Harkness LLP
Date: March 14, 2024
Re: Export Control & Sanctions Compliance Analysis — Channel Reseller Program Agreement between Lumos Analytics Inc. and Meridian Data Solutions GmbH
Matter No.: 1008-00010
This memorandum is protected by the attorney-client privilege and constitutes attorney work product prepared in anticipation of litigation or in connection with the provision of legal advice. It is intended solely for the use of the named recipients and should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP.
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to analyze the export control and sanctions compliance obligations arising from the Channel Reseller Program Agreement (the "Agreement"), execution version dated March 22, 2024, between Lumos Analytics Inc. ("Lumos"), a Delaware C-Corporation headquartered at 4700 Sandhill Road, Suite 300, Palo Alto, California 94304, and Meridian Data Solutions GmbH ("Meridian"), a German limited liability company (Gesellschaft mit beschränkter Haftung) headquartered at Leopoldstraße 78, 80802 München, Germany (registered with the Amtsgericht München under HRB 274581).
The Agreement grants Meridian non-exclusive rights to resell the Lumos Prism™ AI-driven financial analytics and risk-modeling SaaS platform (the "Platform" or "Lumos Prism™") across the EMEA Territory, which encompasses all countries within Europe (including the United Kingdom), the Middle East, and Africa. The aggregate deal value over the five-year initial term (April 1, 2024 through March 31, 2029) is thirty million U.S. dollars ($30,000,000).
This memorandum evaluates the Agreement's compliance posture under three principal regulatory regimes: (1) the U.S. Export Administration Regulations ("EAR"), administered by the Bureau of Industry and Security ("BIS") within the U.S. Department of Commerce; (2) the European Union Dual-Use Regulation, Regulation (EU) 2021/821 (the "EU Dual-Use Regulation"); and (3) the sanctions programs administered by the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC"), together with corresponding sanctions programs maintained by the European Union and the United Kingdom. The analysis also considers the interplay of these regimes with national export control laws in Germany, the United Kingdom, and France, as relevant to Meridian and its pre-approved sub-distributors.
Our overall conclusion is that the Agreement, as drafted, includes robust compliance provisions that are consistent with best practices for the distribution of U.S.-origin software-as-a-service products through channel partners in the EMEA region. The restricted territories prohibition, screening obligations, end-user and end-use restrictions, and termination-for-cause provisions collectively establish a strong contractual framework for managing export control and sanctions risk. However, given the breadth of the EMEA Territory — which inherently encompasses jurisdictions subject to comprehensive or sectoral sanctions, as well as regions characterized by elevated geopolitical risk, particularly within the Middle East and portions of Africa — ongoing monitoring, periodic training, and dynamic updating of compliance procedures will be critical to maintaining a robust compliance posture throughout the term of the Agreement.
Additionally, the two pre-approved sub-distributors — Meridian Data Solutions UK Ltd ("Meridian UK"), responsible for the United Kingdom and Ireland, and Meridian Data Solutions SARL ("Meridian France"), responsible for France, Belgium, Luxembourg, and French-speaking Switzerland — are also within the scope of the compliance obligations analyzed herein. Each sub-distributor operates in a distinct regulatory environment and must comply with local sanctions and export control regimes in addition to the overarching U.S. requirements that flow through from the master Agreement.
The balance of this memorandum sets forth the detailed analysis supporting our conclusions and provides practical compliance recommendations for implementation prior to the April 1, 2024 effective date.
II. Scope of Engagement and Background
A. Engagement Context
Calderwood & Harkness LLP was engaged by Lumos Analytics Inc. on January 30, 2024, pursuant to an engagement letter signed on the same date, to negotiate and draft the Channel Reseller Program Agreement and all ancillary documents relating to Lumos's engagement of Meridian Data Solutions GmbH as a non-exclusive reseller of the Lumos Prism™ platform in the EMEA Territory. The engagement letter authorized Calderwood & Harkness to provide legal advice on all aspects of the transaction, including commercial terms, intellectual property licensing, data privacy, regulatory compliance, and the subject matter of this memorandum — export controls and economic sanctions.
The principal attorneys staffed on this matter are as follows:
• Responsible Partner: Howard Bellamy, Partner, Antitrust & Competition Practice Group
• Billing Partner: Douglas Fairchild, Partner, Real Estate Practice Group
• Lead Associate: Leila Nazari, Senior Associate, Tax Practice Group
• Working Associate: Robert Jansen, Associate, Tax Practice Group (author of this memorandum)
Meridian's outside counsel on this transaction is the firm of Kessler Hartmann Rechtsanwälte PartG mbB, a German partnership with limited professional liability based at Maximilianstraße 35, 80539 München, Germany. Dr. Stefan Kessler serves as the lead partner, and Laura Pfeiffer serves as the working associate on Meridian's side. Calderwood & Harkness has worked closely with the Kessler Hartmann team in negotiating the export control and sanctions provisions of the Agreement, and the provisions described in Section IV below reflect the product of those negotiations.
In addition, Lumos has separately engaged Thornbridge Whitaker LLP as UK and EU regulatory counsel on certain discrete regulatory matters arising from the transaction, including UK-specific sanctions compliance and EU data protection considerations. The lead attorney at Thornbridge Whitaker is Alistair Drummond, Partner, located at 22 Bishopsgate, London EC2N 4BQ. This memorandum has been prepared in coordination with Mr. Drummond's team, though the analysis and conclusions set forth herein represent the independent work product of Calderwood & Harkness LLP.
B. Product Description — Lumos Prism™
Lumos Prism™ is an artificial intelligence–powered financial analytics and risk-modeling software platform designed for use by financial institutions, asset managers, insurance companies, corporate treasury departments, and other sophisticated users of financial data. The platform integrates machine learning algorithms with proprietary quantitative risk models to provide real-time analytics, portfolio stress-testing, credit risk assessment, and regulatory capital optimization. Lumos Prism™ was developed entirely in the United States by Lumos's engineering team, and all intellectual property rights in the platform are owned by Lumos Analytics Inc.
Critically for purposes of this analysis, Lumos Prism™ is delivered exclusively as a cloud-hosted subscription service. There is no on-premises installation and no physical product shipped to end users or resellers. End users access the platform through a web-based interface via encrypted HTTPS connections. For EMEA end users, the platform is hosted at the Frankfurt am Main data center operated by Stratos Cloud Services AG, a Swiss infrastructure-as-a-service provider headquartered at Bahnhofstrasse 42, 8001 Zürich, Switzerland. The Stratos Frankfurt data center provides EMEA-localized hosting to address data residency requirements and to minimize latency for EMEA-based users.
The software-as-a-service delivery model is significant for export control classification purposes. Because no tangible media or physical goods cross international borders, the analysis focuses on the deemed export and deemed reexport provisions of the EAR, as well as on whether cloud-based access to software functionality by end users in various jurisdictions constitutes an "export" or "reexport" for regulatory purposes. As discussed in greater detail in Section III below, BIS guidance on cloud computing confirms that making software functionality available to foreign persons or persons in foreign countries through cloud access can constitute an export or reexport under the EAR.
With respect to EAR classification, our preliminary assessment is that Lumos Prism™ is properly classified as EAR99 — that is, it is an item subject to the EAR but not specifically listed on the Commerce Control List ("CCL") set forth in Supplement No. 1 to Part 774 of the EAR. Lumos Prism™ is a commercial software application designed for financial analytics and risk modeling; it does not incorporate technologies or functionalities that would bring it within any of the specific product categories enumerated on the CCL. However, certain encryption functionalities embedded in the platform require further assessment under Category 5, Part 2 of the CCL, which governs "Information Security" items, including software that employs or performs cryptographic functions. This assessment is discussed in detail in Section III.A.2 below.
C. Territory and Distribution Structure
The Agreement defines the "EMEA Territory" broadly to encompass all countries within Europe (including the United Kingdom and all EU and non-EU European states), the Middle East, and Africa. This is a commercially significant territory that includes approximately 130 countries and territories, spanning a diverse range of legal, political, and regulatory environments.
The arrangement is structured as a non-exclusive channel reseller program. Meridian is authorized to market, promote, and resell subscriptions to the Lumos Prism™ platform to end users within the EMEA Territory, but Lumos retains the right to appoint additional resellers in the territory and to sell directly to end users on its own behalf. Meridian does not acquire any proprietary interest in the platform; rather, it acts as an intermediary between Lumos and end users, who enter into separate end user license agreements ("EULAs") directly with Lumos at the time of subscription activation.
Two sub-distributors have been pre-approved under the Agreement:
1. Meridian Data Solutions UK Ltd ("Meridian UK"), a company registered in England and Wales under Companies House number 12847391, with its registered office at 14 Fenchurch Place, London EC3M 5AJ. The sole director of Meridian UK is Katarina Voss. Meridian UK is authorized to resell within the United Kingdom and Ireland.
2. Meridian Data Solutions SARL ("Meridian France"), a French société à responsabilité limitée registered under SIREN number 912 483 057, with its registered office at 27 Rue de la Boétie, 75008 Paris, France. The Gérant (managing director) of Meridian France is Jean-Philippe Moreau. Meridian France is authorized to resell within France, Belgium, Luxembourg, and French-speaking Switzerland.
Any additional sub-distributors beyond these two pre-approved entities require Lumos's prior written consent, which may be withheld in Lumos's sole and absolute discretion. This consent mechanism provides Lumos with an important gatekeeper function for purposes of export control and sanctions compliance, as it ensures that Lumos can evaluate the compliance posture of any proposed sub-distributor before authorizing it to distribute U.S.-origin software.
It is important to note that the breadth of the EMEA Territory inherently encompasses a number of jurisdictions that are subject to comprehensive or sectoral sanctions imposed by the United States, the European Union, or both. These include, among others, Iran, Syria, and certain regions of Ukraine. Additionally, the Africa sub-region includes countries that, while not comprehensively sanctioned, are subject to targeted or sectoral sanctions programs (e.g., Libya, Somalia, South Sudan, the Central African Republic, the Democratic Republic of the Congo, and others). The Middle East sub-region includes countries such as Iraq, Lebanon, and Yemen that are subject to targeted sanctions programs. The compliance framework must account for this inherent risk.
III. Applicable Regulatory Frameworks
This section provides a detailed overview of the principal regulatory frameworks governing the export, reexport, and distribution of Lumos Prism™ through the Meridian channel reseller program. The analysis addresses each regime in turn, beginning with the U.S. Export Administration Regulations, proceeding to the EU Dual-Use Regulation, and then addressing U.S. OFAC sanctions and their EU and UK counterparts.
A. U.S. Export Administration Regulations (EAR)
1. Jurisdictional Reach
The Export Administration Regulations, codified at 15 C.F.R. Parts 730 through 774, are administered by the Bureau of Industry and Security within the U.S. Department of Commerce. The EAR governs the export, reexport, and transfer (in-country) of all items that are "subject to the EAR," a term defined in 15 C.F.R. § 734.2. Items subject to the EAR include, broadly, all items of U.S. origin (i.e., produced, manufactured, or developed in the United States), as well as certain foreign-made items that incorporate more than a de minimis amount of U.S.-origin controlled content.
Lumos Prism™ is developed by Lumos Analytics Inc., a Delaware C-Corporation headquartered in Palo Alto, California. The platform's source code was written, compiled, and tested entirely within the United States. All intellectual property in the platform is owned by a U.S. person. Accordingly, there is no question that Lumos Prism™ is of U.S. origin and is subject to the EAR. This conclusion holds regardless of the fact that the platform is hosted at a data center in Frankfurt, Germany; the hosting location does not alter the U.S.-origin character of the software itself.
The delivery of Lumos Prism™ as a cloud-hosted SaaS product raises important questions regarding the application of the EAR to cloud-based services. BIS has issued guidance confirming that the making available of software or technology to a foreign person, including through cloud-based access, may constitute an "export" or a "deemed export" under the EAR. Specifically, if the software or technology is stored on a server outside the United States and is accessed by end users in foreign jurisdictions, the provision of access to that software or technology constitutes an export to the jurisdiction where the end user is located. Moreover, if the software is hosted on a server in one foreign jurisdiction (in this case, Germany) and accessed by an end user in a different foreign jurisdiction, the access constitutes a "reexport" from the server location to the end user's location.
Even though Stratos Cloud Services AG operates the EMEA data center in Frankfurt, and even though the data at rest may be physically located in Germany at all times, the U.S.-origin nature of the Lumos Prism™ software means that EAR compliance obligations attach to all instances of the platform's delivery to end users, regardless of the physical location of the server. Lumos, as the exporter of record and the owner of the software, bears primary responsibility for EAR compliance, though Meridian — as the party facilitating access by end users — also has obligations, both under the EAR (to the extent it acts as an agent of Lumos) and under its contractual commitments in the Agreement.
2. Classification of Lumos Prism™
A threshold question for any export control analysis is the proper classification of the item at issue under the Commerce Control List. The CCL, set forth in Supplement No. 1 to Part 774 of the EAR, organizes controlled items into ten categories (Categories 0 through 9), each of which is further divided into product groups (A through E) encompassing systems, equipment, and components; test, inspection, and production equipment; materials; software; and technology. Items that are subject to the EAR but are not specifically listed on the CCL are classified as "EAR99."
Our preliminary assessment is that Lumos Prism™ is properly classified as EAR99. The platform is a commercial software application designed for financial analytics and risk modeling. It does not incorporate technologies or functionalities that would bring it within any of the specific Export Control Classification Numbers ("ECCNs") on the CCL. In particular, Lumos Prism™ is not designed or intended for military applications, does not incorporate sensors, navigation equipment, lasers, propulsion technology, or any other technologies that are commonly controlled under the CCL's product categories. Its primary function is the processing of financial data and the generation of risk analytics for commercial users.
However, the classification analysis cannot stop at EAR99 without further examination of the platform's encryption functionalities. Category 5, Part 2 of the CCL governs "Information Security" items, including software that employs, develops, produces, or performs cryptographic functions. Under ECCN 5D002, software that is "specially designed" or modified for the "use," "development," "production," or support of certain cryptographic equipment or functionality may be controlled. If Lumos Prism™ incorporates encryption algorithms that exceed specified thresholds — for example, if the platform implements AES encryption with key lengths exceeding those permitted under the mass-market exception, or if the platform incorporates proprietary cryptographic functions — a more granular classification analysis would be required.
We recommend that Lumos's engineering team, led by the Chief Technology Officer, provide a detailed technical specification of the encryption parameters used by Lumos Prism™, including: (a) the specific encryption algorithms implemented (e.g., AES-256, RSA, TLS 1.3); (b) the key lengths employed; (c) whether the encryption is integral to the platform's core functionality or is used solely for securing data in transit and at rest; and (d) whether any proprietary or non-standard cryptographic algorithms are used. Based on this information, we can make a definitive classification determination.
Even if certain encryption functionalities bring the platform within the scope of ECCN 5D002, the mass-market encryption exemption under License Exception ENC, codified at 15 C.F.R. § 740.17, is likely available. License Exception ENC permits the export, reexport, and transfer of mass-market encryption items to most destinations without an individual license from BIS, subject to certain self-classification and reporting requirements. If the platform uses standard, commercially available encryption (such as TLS 1.3 for data in transit and AES-256 for data at rest), it would almost certainly qualify for this exemption, as such encryption is widely available in commercial software products.
Recommendation: Lumos should promptly obtain the encryption specifications from its engineering team and, if the platform is determined to incorporate controlled encryption, file a self-classification report with BIS and the National Security Agency ("NSA") as required under 15 C.F.R. § 740.17(b)(1). Lumos should maintain all classification documentation in its export control compliance files.
3. License Exception Considerations
If Lumos Prism™ is classified as EAR99, no license is required for its export or reexport to any destination that is not subject to a comprehensive U.S. embargo or to restrictions imposed by the Entity List, Denied Persons List, or Unverified List. EAR99 items may generally be exported to most countries in the EMEA Territory without a BIS license, subject to the general prohibitions set forth in Part 744 of the EAR (prohibitions based on end-use and end-user).
If the platform's encryption functionalities bring it within ECCN 5D002, the following License Exceptions would be relevant:
• License Exception ENC (15 C.F.R. § 740.17): As discussed above, License Exception ENC is the primary mechanism for exporting encryption items to most destinations. If the mass-market encryption exemption applies, Lumos may export and reexport the platform to virtually all destinations in the EMEA Territory (excluding comprehensively embargoed countries). Lumos must file self-classification and semi-annual sales reports, as applicable.
• License Exception TSR (Technology and Software under Restriction, 15 C.F.R. § 740.6): License Exception TSR permits the export and reexport of certain technology and software to specified destinations. However, if the platform is classified as EAR99, License Exception TSR is not needed. If classified under ECCN 5D002, the availability of License Exception TSR would depend on the destination and the reason for control.
It is critical to note that no license exception is available for exports or reexports to comprehensively embargoed destinations, including Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk, and Luhansk regions of Ukraine. The contractual prohibition on resale into these territories (discussed in Section IV.B below) is therefore not merely a commercial restriction but a legal necessity.
B. EU Dual-Use Regulation — Regulation (EU) 2021/821
1. Scope and Application
The EU Dual-Use Regulation, Regulation (EU) 2021/821 of the European Parliament and of the Council of 20 May 2021 (the "Recast Regulation"), entered into force on September 9, 2021, repealing and replacing the prior Regulation (EC) No 428/2009. The Recast Regulation establishes a Union regime for the control of exports, brokering, technical assistance, transit, and transfer of dual-use items — defined broadly as items, including software and technology, that can be used for both civil and military purposes or that can contribute to the proliferation of weapons of mass destruction.
The EU Dual-Use Regulation is directly relevant to this transaction because Meridian, as a German company, is subject to the Regulation's requirements with respect to its activities as a reseller of the Lumos Prism™ platform. When Meridian facilitates the provision of the platform to end users outside the European Union — for example, to end users in the Middle East or Africa — Meridian is engaging in an "export" of an item from the EU for purposes of the Regulation. The Regulation imposes licensing requirements on the export of items listed in Annex I (the EU Dual-Use Control List), as well as "catch-all" controls that may require authorization even for non-listed items in certain circumstances.
The intra-EU transfer exemption generally applies for movements of dual-use items between EU Member States, meaning that Meridian's resale activities within the EU (e.g., distribution to end users in Germany, France, Belgium, and other EU Member States) would generally not require an export authorization under the EU Dual-Use Regulation. However, exports from the EU to non-EU countries in the Middle East and Africa — as well as to non-EU European countries such as those in the Western Balkans, Turkey, or Ukraine — would be subject to the Regulation's licensing requirements if the items in question are dual-use listed or if the catch-all controls are triggered.
2. Classification Under EU Control Lists
Annex I to the EU Dual-Use Regulation contains the EU Dual-Use Control List, which is aligned with the multilateral export control regimes, including the Wassenaar Arrangement, the Missile Technology Control Regime, the Nuclear Suppliers Group, and the Australia Group. The EU Control List is organized into ten categories mirroring the Wassenaar Arrangement categories.
Lumos Prism™, as a financial analytics software platform, is not typically listed on Annex I to the EU Dual-Use Regulation. Financial analytics software does not fall within any of the product categories that are commonly associated with dual-use items, such as advanced materials, electronics, computers, telecommunications, sensors, lasers, navigation, marine technology, aerospace, or propulsion.
As with the EAR analysis, however, the encryption-related controls under Category 5, Part 2 of Annex I warrant attention. Category 5, Part 2 of the EU Dual-Use Control List mirrors the Wassenaar Arrangement's Information Security controls and covers software that is "specially designed" or modified to use, perform, simulate, or evaluate cryptographic functions. If Lumos Prism™ incorporates controlled encryption, it may fall within the scope of Category 5, Part 2 of Annex I, potentially requiring an EU export authorization for exports to non-EU destinations. However, the same mass-market and publicly available exceptions that apply under the Wassenaar Arrangement (and that are reflected in the EU Regulation's exclusion of items described in the Crypto Note to Category 5, Part 2) would likely apply to a commercial financial analytics platform using standard encryption.
The "catch-all" clause under Article 4 of the Recast Regulation is also noteworthy. Under Article 4, an export authorization is required for non-listed dual-use items if the exporter has been informed by a competent authority that the items are or may be intended, in their entirety or in part, for use in connection with the development, production, handling, operation, maintenance, storage, detection, identification, or dissemination of chemical, biological, or nuclear weapons or other nuclear explosive devices, or for the development, production, maintenance, or storage of missiles capable of delivering such weapons. Additionally, if the exporter itself is aware that the items are intended for such purposes, it must notify the competent authority. For a financial analytics software platform, the risk of triggering the catch-all provision is low, but it cannot be entirely excluded if end users include entities with connections to proliferation-sensitive activities.
Furthermore, the Recast Regulation introduced new controls on cyber-surveillance items under Article 5. These controls apply to items that are not listed in Annex I but that are or may be intended for use in connection with internal repression or the commission of serious violations of human rights and international humanitarian law. Lumos Prism™, as a financial analytics platform, does not appear to fall within the scope of cyber-surveillance items. However, given the breadth of AI-powered analytics capabilities and the evolving interpretation of "cyber-surveillance" under the Regulation, Meridian should be advised to monitor regulatory developments in this area.
3. Obligations for Meridian as EU-Based Reseller
As an EU-based entity engaged in the distribution of items that may be subject to the EU Dual-Use Regulation, Meridian bears independent compliance obligations under the Regulation and under applicable national export control laws. These obligations exist irrespective of the contractual provisions in the Agreement and apply by operation of law.
Specifically, Meridian must:
• Screen all end users and end-uses to determine whether any export authorization is required, whether under Annex I classification, the catch-all provision, or the cyber-surveillance provision.
• Maintain appropriate records of all transactions involving the export of items that may be subject to the Regulation.
• Comply with the national export control laws of Germany, including the Außenwirtschaftsgesetz ("AWG," the German Foreign Trade and Payments Act) and the Außenwirtschaftsverordnung ("AWV," the German Foreign Trade and Payments Regulation), which implement the EU Dual-Use Regulation in Germany and impose additional national controls on certain transactions.
• Report to the German Federal Office for Economic Affairs and Export Control (Bundesamt für Wirtschaft und Ausfuhrkontrolle, "BAFA") if Meridian becomes aware that items it is exporting are or may be intended for a WMD-related end-use.
The Agreement appropriately requires Meridian to comply with these obligations, and the compliance certification mechanism discussed in Section VI.A below provides Lumos with a contractual mechanism for verifying Meridian's compliance on an ongoing basis.
C. U.S. Treasury Department / OFAC Sanctions
1. Overview of OFAC Programs
The Office of Foreign Assets Control, a bureau within the U.S. Department of the Treasury, administers and enforces U.S. economic sanctions programs. OFAC's sanctions programs are among the most extensive in the world and carry significant penalties for violations, including civil penalties of up to approximately $330,000 per violation (or twice the value of the underlying transaction, whichever is greater) and criminal penalties of up to $1,000,000 and 20 years of imprisonment per willful violation.
OFAC administers both country-based (comprehensive) sanctions programs and list-based (targeted) sanctions programs. The key programs relevant to this transaction are as follows:
Comprehensive Sanctions Programs (Country-Based):
• Cuba: Cuban Assets Control Regulations, 31 C.F.R. Part 515. The Cuba embargo is the longest-standing U.S. comprehensive sanctions program, prohibiting virtually all transactions between U.S. persons and Cuba or Cuban nationals.
• Iran: Iranian Transactions and Sanctions Regulations, 31 C.F.R. Part 560. The Iran embargo prohibits virtually all transactions between U.S. persons and Iran or the Government of Iran.
• North Korea: North Korea Sanctions Regulations, 31 C.F.R. Part 510. The North Korea embargo prohibits virtually all transactions between U.S. persons and North Korea or the Government of North Korea.
• Syria: Syrian Sanctions Regulations, 31 C.F.R. Part 542. The Syria embargo prohibits the export or reexport of U.S.-origin services and technology to Syria.
• Crimea, Donetsk, and Luhansk Regions of Ukraine: Executive Order 13685 (Crimea) and related Executive Orders 13660, 13661, and 13662 (broader Ukraine-related sanctions). These programs prohibit new investment in and the export of goods, technology, and services to the Crimea region of Ukraine, as well as certain transactions involving the so-called Donetsk People's Republic and Luhansk People's Republic.
List-Based Sanctions Programs:
• Specially Designated Nationals and blocked Persons ("SDN") List: The SDN List identifies individuals and entities whose property and interests in property are blocked. U.S. persons are generally prohibited from dealing with SDN-listed persons, and all property of SDN-listed persons that comes within U.S. jurisdiction must be blocked (frozen).
• Sectoral Sanctions Identifications ("SSI") List: The SSI List identifies persons subject to certain sectoral prohibitions, primarily in connection with the Russia/Ukraine-related sanctions programs.
• Non-SDN Menu-Based Sanctions ("NS-MBS") List: The NS-MBS List identifies persons subject to one or more of the menu-based sanctions set forth in certain Executive Orders, including restrictions on access to the U.S. financial system, procurement restrictions, and visa restrictions.
• Other OFAC Lists: OFAC maintains additional lists, including the Foreign Sanctions Evaders ("FSE") List, the Non-SDN Palestinian Legislative Council List, and the Capta List.
U.S. persons — a term that includes Lumos Analytics Inc. as a Delaware C-Corporation — are prohibited from engaging in virtually all transactions with comprehensively sanctioned jurisdictions and SDN-listed persons, absent specific authorization from OFAC. The prohibition extends to the provision of services, including software services, to persons or entities in these jurisdictions.
Additionally, OFAC's secondary sanctions authorities create extraterritorial exposure for non-U.S. persons, including Meridian. Under various Executive Orders and statutes, OFAC may impose sanctions on non-U.S. persons that engage in significant transactions with sanctioned persons or jurisdictions. While Meridian is not a "U.S. person" subject to OFAC's primary jurisdiction, Meridian's handling of U.S.-origin software, combined with the secondary sanctions risk, creates a compelling incentive for full compliance.
2. Applicability to Lumos and Meridian
Lumos is unambiguously a "U.S. person" for purposes of all OFAC sanctions programs. As a Delaware C-Corporation headquartered in California, Lumos is subject to the full range of OFAC prohibitions, including the prohibition on exporting, reexporting, or otherwise providing U.S.-origin goods, technology, and services to comprehensively sanctioned jurisdictions and SDN-listed persons.
Meridian, though a German entity, faces OFAC exposure through multiple channels:
1. U.S.-Origin Software: To the extent Meridian facilitates the distribution of Lumos Prism™ — a U.S.-origin software product — Meridian's activities are subject to the EAR, and any diversion of the software to a sanctioned end user or jurisdiction could result in OFAC enforcement action against Lumos and create secondary sanctions exposure for Meridian.
2. Secondary Sanctions Risk: Even absent a direct OFAC nexus, Meridian could face secondary sanctions if it engages in significant transactions involving sanctioned persons or jurisdictions in connection with its resale of the platform.
3. U.S. Dollar Payment Processing: The Agreement provides for payment of reseller commissions and platform fees in U.S. dollars, with payments processed through Pinnacle National Bank, N.A., located at 555 California Street, San Francisco, California 94104. All U.S. dollar transactions clear through the U.S. financial system and are subject to OFAC compliance screening by the correspondent banks involved in the transaction chain. If a payment involves a sanctioned party or jurisdiction, it may be blocked or rejected by the banking institutions, and both Lumos and Meridian could face regulatory scrutiny.
For all of these reasons, the Agreement's OFAC compliance provisions are not merely a matter of contractual risk allocation; they are a legal necessity for Lumos and a practical imperative for Meridian.
D. EU Sanctions Regime
1. EU Restrictive Measures
The European Union implements sanctions — referred to as "restrictive measures" — through Council Decisions adopted under the Common Foreign and Security Policy ("CFSP") and Council Regulations adopted under Article 215 of the Treaty on the Functioning of the European Union ("TFEU"). EU sanctions regulations are directly applicable in all EU Member States and are binding on all persons within the territory of the EU, as well as on EU nationals and entities established or incorporated under the laws of an EU Member State, wherever they are located.
The EU sanctions programs most relevant to this transaction include:
• Russia/Ukraine Sanctions: Council Regulation (EU) No 269/2014 and subsequent amendments, Council Decision 2014/145/CFSP, and related measures imposing asset freezes, travel bans, and sectoral restrictions in response to Russia's actions destabilizing the situation in Ukraine. These measures include specific prohibitions on the export of certain goods, technology, and services to Crimea and Sevastopol, as well as to the non-government-controlled areas of Donetsk and Luhansk.
• Syria Sanctions: Council Regulation (EU) No 36/2012, imposing restrictive measures in view of the situation in Syria, including prohibitions on the export of certain equipment and technology.
• Iran Sanctions: Council Regulation (EU) No 267/2012, concerning restrictive measures against Iran in connection with its nuclear program, including prohibitions on the transfer of certain technologies.
• North Korea Sanctions: Council Regulation (EU) 2017/1509, concerning restrictive measures against the Democratic People's Republic of Korea, implementing comprehensive trade and financial sanctions.
• Country-Specific and Individual-Specific Measures: The EU maintains sanctions programs targeting numerous additional jurisdictions and individuals, including programs relating to Libya, Somalia, South Sudan, the Central African Republic, the Democratic Republic of the Congo, Yemen, Lebanon (Hezbollah-related), and others.
Meridian, as a German company, is directly subject to all applicable EU sanctions regulations by operation of law. Meridian must ensure that its resale activities do not involve any person, entity, or jurisdiction that is subject to EU restrictive measures.
2. Overlap and Divergence with OFAC
There is substantial overlap between OFAC sanctions and EU restrictive measures with respect to several jurisdictions and persons. Both regimes impose comprehensive or near-comprehensive restrictions on Iran, North Korea, and Syria, and both regimes restrict transactions involving the Crimea, Donetsk, and Luhansk regions of Ukraine. The convergence of these regimes simplifies compliance to some degree, as measures taken to comply with one regime will often satisfy the requirements of the other.
However, there are notable areas of divergence that must be carefully managed:
• Cuba: OFAC maintains a comprehensive embargo on Cuba under the Cuban Assets Control Regulations. The EU, by contrast, lifted most of its sanctions on Cuba in 2008, and the EU's Common Position 96/697/CFSP has been largely superseded by the EU-Cuba Political Dialogue and Cooperation Agreement. As a result, Meridian — as a German entity — is not independently prohibited by EU law from engaging in commercial transactions involving Cuba. Nevertheless, the Agreement contractually prohibits Meridian from reselling or providing access to Lumos Prism™ in Cuba. This contractual prohibition is necessary to protect Lumos from OFAC liability, as Lumos — a U.S. person — cannot authorize the distribution of U.S.-origin software to Cuba under any circumstances.
• Russia/Ukraine: While both the U.S. and the EU impose extensive sanctions on Russia and on the Crimea, Donetsk, and Luhansk regions, the specific scope and parameters of the respective sanctions programs differ in certain details, including the lists of designated persons, the categories of goods and services subject to sectoral restrictions, and the available exemptions and authorizations. Meridian must ensure compliance with both regimes, which may in some cases require applying the more restrictive of the two.
• UK Sanctions (Post-Brexit): Following the United Kingdom's withdrawal from the European Union on January 31, 2020, the UK established its own autonomous sanctions regime under the Sanctions and Anti-Money Laundering Act 2018. UK sanctions are administered by the Office of Financial Sanctions Implementation ("OFSI") within HM Treasury. Meridian Data Solutions UK Ltd, as a UK-incorporated entity, is subject to UK sanctions legislation and must comply with the OFSI consolidated list of designated persons. The UK's sanctions regime is largely aligned with the EU's regime but diverges in certain respects, and compliance with one does not automatically ensure compliance with the other.
IV. Analysis of Reseller Agreement Compliance Provisions
This section evaluates the export control and sanctions compliance provisions included in the execution version of the Channel Reseller Program Agreement dated March 22, 2024. The provisions discussed below were the subject of extensive negotiation between Calderwood & Harkness and Kessler Hartmann Rechtsanwälte PartG mbB and reflect a carefully balanced framework designed to protect Lumos's compliance position while preserving commercial flexibility for Meridian.
A. Anti-Corruption, Sanctions, and Export Control Representations
The Agreement contains mutual representations and warranties regarding compliance with applicable anti-corruption and trade compliance laws. Specifically, both Lumos and Meridian represent and warrant that they are, and shall remain throughout the term of the Agreement, in compliance with:
• The United States Foreign Corrupt Practices Act of 1977, as amended (the "FCPA"), 15 U.S.C. §§ 78dd-1 et seq.;
• The United Kingdom Bribery Act 2010;
• All applicable local anti-corruption laws in each jurisdiction in which the parties operate; and
• All applicable export control and sanctions laws, including the U.S. Export Administration Regulations (15 C.F.R. Parts 730–774), the EU Dual-Use Regulation (EU) 2021/821, all OFAC-administered sanctions programs, and all applicable EU and UK sanctions programs.
These representations are made as of the date of the Agreement and are deemed to be continuously repeated throughout the term. A breach of any of these representations constitutes a material breach of the Agreement and triggers the termination-for-cause provision discussed in Section IV.E below.
Assessment: The scope of these representations is appropriate and consistent with market practice for cross-border technology distribution agreements involving U.S.-origin products. The inclusion of the FCPA and UK Bribery Act representations, while not directly related to export controls, addresses the broader compliance risk landscape associated with sales activity in the EMEA Territory, particularly in the Middle East and Africa, where corruption risks are elevated in certain jurisdictions.
B. Restricted Territories Prohibition
The Agreement contains an express prohibition on the resale, distribution, or provision of access to Lumos Prism™ in OFAC-comprehensively-sanctioned territories. Specifically, Meridian is prohibited from directly or indirectly selling, licensing, sublicensing, distributing, or otherwise making available the Lumos Prism™ platform, or any component thereof, to any person, entity, or end user located in, organized under the laws of, or ordinarily resident in any of the following "Restricted Territories":
• Cuba
• Iran (the Islamic Republic of Iran)
• North Korea (the Democratic People's Republic of Korea)
• Syria (the Syrian Arab Republic)
• The Crimea region of Ukraine
• The Donetsk region of Ukraine (including the territory controlled by the so-called "Donetsk People's Republic")
• The Luhansk region of Ukraine (including the territory controlled by the so-called "Luhansk People's Republic")
This list is current as of the March 22, 2024 signing date and reflects the jurisdictions that are subject to comprehensive OFAC sanctions as of that date.
Assessment: The Restricted Territories list is accurate and complete as of the date of the Agreement. However, we note a potential gap: the list as drafted is static — it enumerates specific jurisdictions as of a fixed date. If OFAC were to designate an additional jurisdiction as subject to comprehensive sanctions during the term of the Agreement (which runs through March 31, 2029, with potential for renewal), the static list would not automatically capture the newly designated jurisdiction.
Recommendation: We recommend that the Agreement include a contractual mechanism for automatic updates to the Restricted Territories list. This could be accomplished by defining "Restricted Territories" to include, in addition to the enumerated jurisdictions, "any other country, territory, or region that becomes subject to comprehensive U.S. sanctions during the term of this Agreement." Alternatively, the Agreement could provide for periodic updates to the Restricted Territories list, with Lumos having the unilateral right to add jurisdictions by written notice to Meridian. We understand that the execution version includes a reference to updates by operation of law, but we recommend confirming that the language is sufficiently broad to capture all potential scenarios.
C. Screening Obligations
The Agreement imposes detailed screening obligations on Meridian, requiring Meridian to screen all end users (and their beneficial owners, to the extent reasonably ascertainable) against the following restricted party lists prior to completing any resale transaction:
• OFAC Lists: The SDN List, the SSI List, the NS-MBS List, the FSE List, and any other list maintained by OFAC;
• EU Consolidated Financial Sanctions List: The consolidated list of persons, groups, and entities subject to EU financial sanctions, as maintained by the European Commission;
• UK OFSI Consolidated List: The consolidated list of persons and entities subject to UK financial sanctions, as maintained by the Office of Financial Sanctions Implementation;
• BIS Lists: The Entity List (Supplement No. 4 to Part 744 of the EAR), the Denied Persons List (maintained under Part 764 of the EAR), and the Unverified List (Supplement No. 6 to Part 744 of the EAR).
Meridian is required to perform this screening at the time of initial onboarding of each end user and to re-screen its entire end user base on a periodic basis not less frequently than quarterly. Meridian must maintain complete records of all screening activities, including the date of each screening, the lists checked, the results obtained, and any remedial actions taken, for a period of not less than five (5) years from the date of each screening. This five-year recordkeeping requirement is consistent with the recordkeeping obligations imposed by the EAR under 15 C.F.R. Part 762, which requires that persons subject to the EAR retain records of export transactions for five years from the date of export, reexport, or transfer.
Meridian's General Counsel, Dr. Anneliese Brandt, has confirmed in writing (via email dated February 28, 2024, to Leila Nazari at Calderwood & Harkness) that Meridian maintains an automated restricted party screening platform that is integrated into its customer relationship management system. Dr. Brandt represented that this platform is updated daily with the latest consolidated sanctions lists from OFAC, the EU, and the UK, and that screening is performed automatically at the time of customer onboarding and on a rolling basis thereafter. While this representation provides a degree of comfort, we recommend that Lumos exercise its contractual audit rights (discussed in Section VI.A below) to verify the effectiveness of Meridian's screening procedures on a periodic basis.
Assessment: The screening obligations in the Agreement are comprehensive and align with best practices for export control and sanctions compliance in channel distribution arrangements. The inclusion of all major OFAC, EU, UK, and BIS lists ensures broad coverage, and the five-year recordkeeping requirement provides an adequate audit trail.
D. End-User / End-Use Restrictions
In addition to the Restricted Territories prohibition and the screening obligations, the Agreement contains express restrictions on the end users and end-uses to which Meridian may resell the Lumos Prism™ platform. Specifically, the Agreement prohibits Meridian from reselling, distributing, or providing access to the platform to any end user that Meridian knows or has reason to know will use the platform for any of the following purposes:
• The design, development, production, stockpiling, or use of chemical, biological, or nuclear weapons, or of missiles capable of delivering such weapons (collectively, "WMD Proliferation Activities");
• Military end-uses in any country that is subject to an arms embargo imposed by the United States, the European Union, the United Nations Security Council, or any other applicable authority;
• Any other purpose that is prohibited by applicable export control laws, sanctions laws, or anti-terrorism laws.
The "knows or has reason to know" standard employed in this provision is consistent with the knowledge standard used in the EAR's general prohibitions (15 C.F.R. § 744.6) and with the catch-all provisions of the EU Dual-Use Regulation (Article 4). Under this standard, Meridian is not required to have actual knowledge of a prohibited end-use; rather, Meridian is prohibited from completing a transaction if, in the exercise of reasonable diligence, it should have known that the end use was prohibited. This standard imposes an affirmative duty of inquiry on Meridian when there are "red flags" suggesting a potentially prohibited end use — for example, if an end user refuses to provide information about the intended use of the platform, requests unusual technical modifications, or is located in a jurisdiction of concern.
Assessment: The end-user and end-use restrictions are appropriately drafted and consistent with both U.S. and EU regulatory standards. The "knows or has reason to know" standard strikes an appropriate balance between imposing meaningful compliance obligations on Meridian and avoiding an unrealistic standard of absolute liability for end-use diversions that Meridian could not reasonably have anticipated.
E. Termination for Cause (Sanctions/Export Control Breach)
The Agreement provides for immediate termination without a cure period in the event of any of the following:
• Any violation of applicable export control or sanctions laws by Meridian, any of its sub-distributors, or any of its affiliates in connection with the resale or distribution of Lumos Prism™;
• Any designation of Meridian, any of its sub-distributors, any of its affiliates, or any of its officers or directors on any restricted party list maintained by OFAC, the EU, the UK, or BIS.
This termination right is significantly more stringent than the standard termination-for-cause provision elsewhere in the Agreement, which provides for a thirty (30) day cure period following written notice of a material breach. The elimination of the cure period for sanctions and export control violations reflects the severity of the compliance risk: a sanctions or export control violation can expose Lumos to criminal prosecution, civil penalties, loss of export privileges, reputational harm, and potential debarment from government contracts. Given these consequences, it would be commercially unreasonable — and potentially legally impermissible — for Lumos to continue the relationship during a cure period while an active violation remains unresolved.
Assessment: The immediate termination right for sanctions and export control violations is appropriate, proportionate, and consistent with market practice for agreements involving U.S.-origin technology. The inclusion of affiliates, sub-distributors, and officers/directors within the scope of the designation trigger provides comprehensive protection against the risk that a connected party's sanctions designation could taint the entire distribution chain.
F. Meridian's Indemnification Obligations
Under the indemnification framework set forth in the Agreement, Meridian is obligated to indemnify, defend, and hold harmless Lumos, its officers, directors, employees, agents, and affiliates from and against any and all losses, liabilities, damages, costs, and expenses (including reasonable attorneys' fees and expenses) arising out of or resulting from Meridian's failure to comply with applicable export control and sanctions laws in connection with the resale or distribution of Lumos Prism™.
The Agreement establishes an aggregate indemnification cap of fifteen million U.S. dollars ($15,000,000), which represents fifty percent (50%) of the total contract value over the five-year initial term. However, the Agreement provides that this cap does not apply to losses arising from willful misconduct, fraud, or intentional breach of the Agreement by the indemnifying party. A deliberate violation of sanctions laws — for example, a knowing resale of the platform to an end user in a comprehensively sanctioned territory — would almost certainly constitute "willful misconduct" under this provision, thereby exposing Meridian to uncapped indemnification liability.
Additionally, the Agreement provides for a five percent (5%) escrow holdback on all quarterly payments due from Lumos to Meridian, with the escrowed amounts held by Evergreen Trust Company, N.A. (Maria Gutierrez, escrow officer) in a segregated interest-bearing account. The escrow holdback provides a readily accessible source of funds for the satisfaction of indemnification claims, including claims arising from export control or sanctions violations.
Assessment: The indemnification framework provides meaningful protection for Lumos against the financial consequences of Meridian's non-compliance. The carve-out for willful misconduct ensures that Meridian cannot shield itself from liability for deliberate violations by relying on the aggregate cap. The escrow holdback provides liquidity for indemnification claims, reducing the risk that Lumos would need to pursue protracted collection efforts against a German entity in the event of a claim.
V. Restricted Territories — Detailed Analysis
This section provides a jurisdiction-by-jurisdiction analysis of the Restricted Territories identified in the Agreement, examining the applicable U.S. and EU sanctions regimes, areas of regulatory convergence and divergence, and specific compliance considerations for each territory.
A. Cuba
OFAC Regime: The Cuban Assets Control Regulations, 31 C.F.R. Part 515, administered by OFAC, constitute one of the most comprehensive sanctions programs maintained by the United States. The Cuba embargo prohibits virtually all transactions between U.S. persons and Cuba or Cuban nationals, including the export, reexport, or provision of goods, technology, and services of U.S. origin. The provision of cloud-based software access to a person in Cuba would constitute an export of services to Cuba and is prohibited absent a specific license from OFAC.
EU Regime: The European Union's approach to Cuba has diverged significantly from the U.S. approach in recent years. The EU lifted most of its sanctions on Cuba in 2008, and the EU's Common Position 96/697/CFSP — which had conditioned bilateral relations on progress toward democratic reform — has been largely superseded by the EU-Cuba Political Dialogue and Cooperation Agreement (PDCA), signed in 2016. As a result, there are currently no comprehensive EU sanctions on Cuba, and Meridian — as a German entity — is not independently prohibited by EU law from engaging in commercial transactions with Cuban persons or entities.
Divergence Issue: This is a critical area of divergence between the U.S. and EU regimes. Meridian may argue, from an EU law perspective, that it is free to resell software to Cuban end users. However, because Lumos Prism™ is U.S.-origin software and Lumos is a U.S. person, any authorization by Lumos for Meridian to distribute the platform in Cuba would constitute a violation of the Cuban Assets Control Regulations. The contractual prohibition on resale into Cuba is therefore an absolute legal necessity from Lumos's perspective, not merely a commercial preference.
Recommendation: Maintain the contractual prohibition on resale into Cuba. Lumos cannot, under any circumstances, authorize the distribution of U.S.-origin software to Cuba. Meridian should be advised that this prohibition is legally mandated and non-negotiable.
B. Iran
OFAC Regime: The Iranian Transactions and Sanctions Regulations, 31 C.F.R. Part 560, prohibit virtually all transactions between U.S. persons and Iran, the Government of Iran, and Iranian financial institutions. The provision of software and technology services to persons in Iran is prohibited, and the broad scope of the embargo extends to cloud-based services accessed from within Iran.
EU Regime: Council Regulation (EU) No 267/2012 imposes restrictive measures against Iran in connection with its nuclear program. The EU Iran sanctions include prohibitions on the sale, supply, transfer, or export of certain goods and technology to Iran, as well as restrictions on financial services and investment. While the EU Iran sanctions are not as comprehensive as the OFAC embargo (the EU's Joint Comprehensive Plan of Action (JCPOA) implementation led to the lifting of certain EU nuclear-related sanctions), the remaining EU measures are substantial and include restrictions on technology transfers that could encompass software platforms.
Convergence: Both regimes prohibit the provision of software and technology to Iran. Cloud access from Iran to the Lumos Prism™ platform would constitute an export under both the EAR and the EU Dual-Use Regulation and would violate both OFAC sanctions and applicable EU restrictive measures.
Recommendation: Meridian must implement robust geo-blocking measures to prevent access to the Lumos Prism™ platform from IP addresses originating in Iran. Lumos should coordinate with Stratos Cloud Services AG to implement IP-address-based access controls at the infrastructure level, supplementing any application-level controls implemented by Lumos's engineering team.
C. North Korea
OFAC Regime: The North Korea Sanctions Regulations, 31 C.F.R. Part 510, impose a comprehensive embargo prohibiting virtually all transactions between U.S. persons and North Korea, the Government of North Korea, or the Workers' Party of Korea. The export of goods, technology, and services to North Korea is prohibited.
EU Regime: Council Regulation (EU) 2017/1509 imposes comprehensive restrictive measures against the Democratic People's Republic of Korea, including prohibitions on the export of all goods and technology, restrictions on financial services, and asset freezes on designated persons and entities.
Convergence: There is near-total convergence between the U.S. and EU regimes with respect to North Korea. Both impose comprehensive restrictions that would prohibit the provision of the Lumos Prism™ platform to any person or entity in North Korea.
Practical Risk Assessment: The practical risk of an end user in North Korea accessing a commercial financial analytics SaaS platform is minimal, given North Korea's extremely limited integration into the global commercial software market, its restricted internet connectivity, and the absence of a meaningful commercial banking sector that would require sophisticated financial analytics tools. Nevertheless, the contractual prohibition and screening obligations are essential as a matter of legal compliance and to guard against the possibility of North Korean front companies or agents operating through third countries within the EMEA Territory.
D. Syria
OFAC Regime: The Syrian Sanctions Regulations, 31 C.F.R. Part 542, prohibit the export or reexport of U.S.-origin services and technology to Syria, as well as new investment in Syria and the provision of financial services involving Syria.
EU Regime: Council Regulation (EU) No 36/2012 imposes restrictive measures against Syria, including prohibitions on the export of certain equipment and technology, restrictions on oil imports, and asset freezes on designated persons. The EU Syria sanctions are extensive but differ from the OFAC regime in certain respects, including the scope of technology restrictions and available humanitarian exemptions.
Convergence: Both regimes prohibit the export of software and technology to Syria, and the provision of cloud-based access to the Lumos Prism™ platform to end users in Syria would violate both regimes.
Recommendation: Maintain the contractual prohibition on resale into Syria. Implement geo-blocking controls for Syrian IP addresses. Monitor the evolving political situation in Syria, as changes in the geopolitical landscape could lead to modifications in the sanctions regimes applicable to Syria. If sanctions are relaxed in the future, Lumos and Meridian may reassess the commercial opportunity, but any change to the Restricted Territories list should be made only after careful legal analysis and, if necessary, consultation with OFAC and/or BIS.
E. Crimea, Donetsk, and Luhansk Regions of Ukraine
OFAC Regime: